Description
The product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer.
Potential Impact
- Confidentiality: Read Memory
- Availability: DoS: Crash, Exit, or Restart
- Integrity: Execute Unauthorized Code or Commands
Detection Methods
- Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin...
- Automated Dynamic Analysis: Use tools that are integrated during
compilation to insert runtime error-checking mechanisms
related to memory safety errors, such as AddressSanitizer
(ASan) for C/C++ [REF-1518]....
Related Weaknesses
References
View on MITRE CWE Database →
